Medical Equipment Cybersecurity Compliance Assessment

The contract seeks a small business to evaluate medical devices for compliance with the Risk Management Framework cybersecurity requirements, ensuring that all equipment meets established defense standards for security and resilience. The work involves close coordination with cybersecurity offices to assess, document, and report the security posture of medical devices used in operational environments, with a focus on identifying vulnerabilities, implementing necessary controls, and maintaining accurate records of compliance status. The evaluation process must align with federal cybersecurity guidelines and ensure that medical equipment remains secure throughout its lifecycle. Performance is required at the location in Frederick, Maryland, with a deadline for responses set for May 21, 2026. The contracting activity is part of the Department of Defense’s 771 Enterprise Sourcing Squadron under the FA8003 contract vehicle, and the solicitation is a total small business set-aside, limiting eligibility to qualified small businesses as defined by the Small Business Administration. The North American Industry Classification System code 541512 indicates this is for computer systems design and related services, underscoring the technical and analytical nature of the required work. All deliverables must be precise, defensible, and aligned with DoD cybersecurity objectives.